Identity theft and financial fraud cost Americans over $10 billion per year — and the number keeps climbing as more financial life moves online. The good news is that most of the protections available are free, take less than an hour to set up, and dramatically reduce your exposure. You don’t need to become a security expert. You just need to do a handful of specific things that most people haven’t gotten around to yet.
Freeze Your Credit — It’s Free and Takes 10 Minutes
A credit freeze is the single most effective protection against new account fraud. It prevents lenders from accessing your credit report, which means even if a fraudster has your Social Security number and personal information, they cannot open a new credit card, take out a loan, or start a utility account in your name — because no lender will extend credit without seeing your report first.
Since 2018, credit freezes have been free by law. You need to freeze with all three bureaus separately:
- Equifax — equifax.com/personal/credit-report-services
- Experian — experian.com/freeze
- TransUnion — transunion.com/credit-freeze
Each takes about three to five minutes. You’ll get a PIN or login to temporarily lift the freeze when you legitimately need to apply for credit (a mortgage, a car loan, a new card). Lift it for the application window, then re-freeze. It’s a minor inconvenience with a major protective benefit.
Set Up Transaction Alerts on Every Account
Go into every bank account, credit card, and investment account you have and enable transaction alerts — ideally for every transaction, or at minimum for any transaction above $1. Most banks let you set this up in the app settings under “Notifications” or “Alerts.”
This does two things. First, it catches fraudulent transactions in real time rather than when you get your monthly statement — giving you a much better chance of recovering the money before the trail goes cold. Second, it provides a running awareness of your account activity that makes you significantly less likely to miss unusual charges. The person who gets a notification for every transaction is impossible to quietly defraud over months. The person who checks their statement monthly is not.
Use Strong, Unique Passwords for Every Financial Account
Data breaches are inevitable. Some company you have an account with will be breached, and your email and password combination will end up in a database of stolen credentials. If you use the same password across multiple sites — which most people do — fraudsters test those credentials on financial sites automatically. This is called credential stuffing, and it’s one of the most common causes of financial account takeover.
The fix is a password manager. Tools like 1Password, Bitwarden (free and open source), and Dashlane generate and store strong unique passwords for every site. You remember one master password; the manager handles everything else. Setting one up takes about 30 minutes and eliminates the credential stuffing risk entirely — because even if one site is breached, the password isn’t reused anywhere that matters.
Enable Multi-Factor Authentication Everywhere
Multi-factor authentication (MFA) requires a second verification step — a code from an app, a text message, or a hardware key — in addition to your password. Even if a fraudster has your username and password, they cannot access the account without the second factor.
Enable MFA on every financial account that offers it: banks, brokerages, credit cards, your email account (especially important — your email is the recovery mechanism for almost every other account), and your Social Security account at ssa.gov. App-based MFA (Google Authenticator, Authy, or an authenticator built into 1Password) is more secure than SMS-based MFA, since SIM swap attacks can intercept text codes. But SMS MFA is significantly better than no MFA — enable whatever the account offers.
Check Your Credit Reports Annually
You are entitled to one free credit report per year from each of the three bureaus at annualcreditreport.com — the official government-mandated site. (During the pandemic, weekly free reports became available and have remained available as of 2025.) Check each report for:
- Accounts you don’t recognise — a card opened in your name you didn’t open
- Inquiries you didn’t authorise — someone checking your credit for a loan application
- Addresses or employers you’ve never had — signs someone has your identity linked to a different address
- Negative marks on accounts that are yours but that you thought were in good standing
Dispute errors directly with the bureau online — the process takes about 15 minutes per dispute and the bureau is required to investigate within 30 days. Errors on credit reports are more common than most people realise and can significantly affect your credit score and borrowing costs until corrected.
What to Do If You’re Already a Victim
If you discover fraudulent activity, the response sequence matters:
- Contact the financial institution immediately — call the number on the back of the card or on the bank’s official website, not any number in a suspicious email or text
- Place a fraud alert with one bureau — they are required to notify the other two. This makes lenders take extra steps before opening new credit.
- File a report at identitytheft.gov — the FTC’s official resource. It creates a personalised recovery plan and generates official documentation you’ll need for disputes.
- Freeze your credit at all three bureaus — if you haven’t already, do it immediately
- Change passwords and enable MFA on any account that might have been accessed
Most fraud is recoverable — banks and credit card companies are legally required to reverse fraudulent charges in most circumstances if reported promptly. The faster you act, the better the outcome. Don’t wait to see if it resolves itself.
The Setup That Takes One Saturday Afternoon
The complete fraud protection setup — credit freeze at all three bureaus, transaction alerts on every account, password manager with unique passwords, MFA on all financial and email accounts — takes about two to three hours to complete properly. It’s a one-time investment that significantly reduces your exposure to the most common forms of financial fraud indefinitely. Block the time. Do it this weekend. The cost of not doing it is not hypothetical — identity theft affects approximately 15 million Americans per year, and the recovery process takes an average of 200 hours when it does happen. Two hours now versus 200 hours later is not a close call.
Protecting Your Social Security Number
Your SSN is the master key to your financial identity. Treat it accordingly:
- Never carry your Social Security card in your wallet — memorise the number and leave the card secured at home
- Do not give your SSN on forms or calls unless you understand exactly why it is required and have verified you’re dealing with a legitimate organisation
- Create an account at ssa.gov to lock your SSN from being used for new benefit claims — this prevents criminals from redirecting your Social Security benefits
- Be sceptical of any entity requesting your SSN for a purpose that doesn’t legally require it — many do ask unnecessarily, and declining is usually fine
Financial fraud protection is not a one-time task — it is a set of ongoing habits and a foundation of specific protective measures. The one-time setup (credit freeze, password manager, MFA) does the heavy lifting permanently. The ongoing habits (checking account alerts, annual credit report review, appropriate SSN hygiene) require minimal time and provide significant ongoing protection. Build both. The financial damage from identity theft is recoverable but costly in time and stress. The protection is cheap. This is one of the clearest cost-benefit cases in personal finance.
The two hours this weekend are an investment against 200 hours of recovery. Do the credit freeze first — it’s the highest impact item — then work through the rest of the list. Your future self will not regret it.
Security is one area where the upfront setup pays indefinitely. The credit freeze is free and takes ten minutes. Do it today before you close this tab.
